0

I wanted to know the hosts that were up on my network. So while working with Nmap I couldn't understand why using the command nmap -sn 192.168.2.1/150 it didn't want to tell me the hosts that were up, But then after using nmap -sn 192.168.2.*, it worked for me instead of the other one. Can somebody explain me this event?

  • 5
    Why did you use 192.168.2.1/150? What were you thinking that would do? – schroeder Dec 30 '17 at 20:44
  • 1
    Maybe they meant the range 192.168.2.1-150. – Ben S Dec 30 '17 at 22:35
  • I was using 192.168.2.1/150 because the devices of my network are above 192.168.2.100 :) – VladiC4T Dec 31 '17 at 20:47
15

Your first example uses the CIDR notation to specify the host range as a netmask.

But since /150 is an illegal value for an IPv4 subnet mask, nmap falls back to the largest plausible value which is /32 (because an IPv4 address only has 32 bits), making you scan exactly one host:

$ nmap -sn 192.168.2.1/150

Starting Nmap 7.60 ( https://nmap.org ) at 2017-12-30 19:45 CET
Illegal netmask in "192.168.2.1/150". Assuming /32 (one host)
Nmap scan report for easy.box.local (192.168.2.1)
Host is up (0.0026s latency).
Nmap done: 1 IP address (1 host up) scanned in 0.01 seconds

The CIDR-noted range equivalent to

$ nmap -sn "192.168.2.*"

is

$ nmap -sn 192.168.2.1/24

because 255.255.255.0 has 24 leading 1 bits.

You can verify that assumption with more verbosity (-v):

$ nmap -sn -v 192.168.2.1/24

Starting Nmap 7.60 ( https://nmap.org ) at 2017-12-30 19:58 CET
Initiating Ping Scan at 19:58
Scanning 256 hosts [2 ports/host]
Completed Ping Scan at 19:58, 2.40s elapsed (256 total hosts)
Initiating Parallel DNS resolution of 256 hosts. at 19:58
Completed Parallel DNS resolution of 256 hosts. at 19:58, 0.06s elapsed
Nmap scan report for 192.168.2.0 [host down]
Nmap scan report for 192.168.2.1 [host down]
...
Nmap scan report for 192.168.2.255 [host down]
Read data files from: /usr/bin/../share/nmap
Nmap done: 256 IP addresses (2 hosts up) scanned in 2.47 seconds
2

The specified network to scan in this command nmap -sn 192.168.2.1/150 is invalid.

You requested prefix 150, but it is invalid.

If you want to scan 192.168.2.*, you should use prefix 24.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.